> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/cortex-cli-workflow.md).

# Cortex CLI workflow

The Cortex CLI operates at the CI enforcement point, the second shift-left stage after IDE scanning. Blocking a finding at CI scan prevents the vulnerable artifact from being deployed to production, reducing blast radius and remediation cost compared to detection at periodic scan or runtime.

The Cortex CLI evaluates findings against Unified Application Security Policies during CI code scans. The CLI is a scan-time policy consumer, **the CLI does not support creating, editing, viewing, or deleting policies**. All policy management operations (create, edit, delete, enable, disable) are performed exclusively through the [tenant workflow](/application-security/application-security-posture-management-aspm/unified-application-security-policies/tenant-ui-workflow.md) or the [API workflow](/application-security/application-security-posture-management-aspm/unified-application-security-policies/api-workflow.md).

**How the CLI evaluates policies**

During a scan, the CLI checks your findings against the active Unified Application Security Policies in your environment. Based on this evaluation, the CLI determines:

* Which findings violate your policies
* Whether the scan should fail the pipeline (Block CI)
* If an active grace period applies to any of the findings

The CLI uses the policy correlation results to determine the scan exit code and generate the CLI report.

**CLI policy output**

The Cortex CLI scan output includes the following policy-related information:

| Output element             | Description                                                                                                                              |
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Policy-reported count      | The total number of findings that matched at least one active policy. Displayed in the scan summary                                      |
| Blocking policy details    | The names and IDs of all policies that triggered a Block CI action. Displayed in the scan summary                                        |
| Per-finding policy matches | Each finding in the CLI report includes a policies array listing the matched policy IDs and whether each policy blocks the CI pipeline   |
| Grace period indicator     | When a finding matches a blocking policy but the grace period is active, the CLI logs the remaining days and does not block the pipeline |
| Platform upload link       | A link to the Cortex Cloud platform where the full scan results and policy details are available                                         |

**CLI flags that affect policy behavior**

| Flag             | Description                                                                                                                                                                         |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--soft-fail`    | Run scans and evaluate policies but always return exit code 0, regardless of blocking policy matches. Use `--soft-fail` to test policy configurations without blocking CI pipelines |
| `--blocked-only` | Filter the CLI report output to display only findings that matched a blocking policy                                                                                                |
| `--severity`     | Filter findings by severity level before policy evaluation. Findings below the specified severity threshold are excluded from the CLI report                                        |
| `--upload-mode`  | Control whether scan results are uploaded to the platform. When set to no-upload, the CLI evaluates policies locally without uploading results                                      |

**CLI exit codes**

| Exit code | Condition                                                                          |
| --------- | ---------------------------------------------------------------------------------- |
| `0`       | No blocking policy matches found, or `--soft-fail` is enabled                      |
| `1`       | At least one finding matched a blocking policy and `--soft-fail` is not enabled    |
| `2`       | An internal error occurred during the scan and `--no-fail-on-crash` is not enabled |

**Reference**

For more information about the Cortex CLI, refer to [Cortex CLI](https://app.gitbook.com/s/AEIjuYE3RXcIfmuQnBbm/cortex-cli).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/cortex-cli-workflow.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.